Threat database

A missing authorization vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension, leveraging social engineering. The vulnerability has a medium severity rating with a CVSS score of 6.5. This issue was addressed in Chrome version 155.0.8059.39.

An incorrect authorization vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39 allows a remote attacker to leak cross-origin data via a crafted HTML page using social engineering techniques. The vulnerability has a CVSS score of 4.3, indicating medium severity. The issue is addressed in Chrome version 155.0.8059.39.

A vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy due to incorrect authorization in the Scheduling component. This issue has been assigned CVE-2026-106297 and is rated as medium severity with a CVSS score of 4.3. The vulnerability requires user interaction and does not result in confidentiality or availability impact but can cause integrity issues. Google has released an update to address this flaw.

CVE-2026-106287 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving information loss in the Cross-Origin Resource Sharing (CORS) mechanism. This flaw allows a remote attacker to bypass the web origin policy via crafted network traffic. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. The issue affects versions before 155.0.8059.39.

CVE-2026-106252 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving an incorrect comparison in font handling. This flaw could allow a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

A confused deputy vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions to a privileged page via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. Google has published a stable channel update addressing this issue.

An incorrect authorization vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39 allows a local attacker to bypass system access restrictions by using a crafted HTML page. The issue has been assigned a medium severity rating with a CVSS score of 5.4. This vulnerability affects versions before 155.0.8059.39 and has been publicly disclosed.

A vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to leak cross-origin data by exploiting incomplete cleanup in the Glic component. The attack requires user interaction via social engineering and results in limited confidentiality impact without affecting integrity or availability. The issue has a medium severity rating with a CVSS score of 4.3.

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106309 is an incorrect authorization vulnerability in the Selection component of Google Chrome on iOS. It affects versions prior to 155.0.8059.39 and allows a remote attacker to obtain sensitive information by crafting a malicious HTML page. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in version 155.0.8059.39.

CVE-2026-106250 is a vulnerability in Google Chrome prior to version 155.0.8059.39 where missing authorization in an Actor component allows a remote attacker to bypass system access restrictions via a crafted HTML page using social engineering. The issue has a medium severity rating with a CVSS score of 5.4. A fix is available in Chrome version 155.0.8059.39.

Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106312 is a missing authorization vulnerability in the SignIn component of Google Chrome before version 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking users into installing a crafted Chrome extension. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-106353 is a medium severity vulnerability in Google Chrome for iOS versions prior to 155.0.8059.39. It involves improper input validation that allows a remote attacker, using social engineering, to bypass the web origin policy via a co-installed app. The vulnerability does not impact confidentiality but can affect integrity. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm patch status.

A confused deputy vulnerability in DeviceBoundSessionCredentials in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. The issue has a low security severity rating from Chromium and a CVSS score of 4.3 (medium severity).

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process and uses social engineering to bypass system access restrictions via a crafted HTML page. The issue has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106317 is a medium severity UI misrepresentation vulnerability in Google Chrome on Android. It allows a remote attacker to spoof the address bar by using a crafted HTML page in fullscreen mode. This could mislead users about the actual website they are visiting. The issue is fixed in Chrome version 155.0.8059.39.

A UI misrepresentation vulnerability in the PictureInPicture feature of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to spoof the address bar via a crafted HTML page. This vulnerability has a medium severity rating and does not have known exploits in the wild. It affects versions before 155.0.8059.39.

A UI misrepresentation vulnerability exists in the Payments feature of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to use social engineering techniques to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106340 is a medium severity vulnerability in Google Chrome on Windows prior to version 155.0.8059.39. It involves missing authorization in the CredentialProvider component, allowing a local attacker with physical access to obtain sensitive information. The vulnerability does not require user interaction and has no known exploits in the wild. Google has released an update to fix this issue.